Comment by godelski 20 hours ago
If your number is seized then the new account holder has no chat history. i.e. the vault is cleared out. In that situation you will also be kicked out, clearly telling you that your account has been hijacked.
You can also lock registration of your device.
What is your security concern here?
Please actually read
> Registration Lock expires after 7 days *of inactivity*
If you use signal once a week you're fine. Maybe it should be longer but that's a different argument and there's no reason to be disingenuous about it
am I reading it wrong? but on my phone if i activate reglock again it says that if pin fails the account is blocked for seven days. I asume that after 7 days one still needs the pin to register or am i wrong?
You'll get the opportunity to change the pin.
There's a balance they want to strike. You can't assume phone numbers are unique to a person across time. So they need to be able to expire when someone stops using a number.
But again, acting on the other side also gets a notification in the chat stating that the security number has changed. The new person doesn't have the signal chat history. So if you're talking about sensitive things then it's a strong indication you should reverify their identity. Not practical for every day users but that's also not a typical threat scenario
If you have done the out-of-band safety number verification, then impersonation attempts will give you a warning that their safety number has changed. I know this because I got that error when my wife replaced her cell phone.
I believe (though I haven't verified it myself) that even if you haven't verified the numbers using an out-of-band exchange mechanism, you will get a warning if the safety number as observed by their server changes. I believe they would need to know your Signal PIN to restore from backup, which means that even if you've set that it will give an alert, presuming basic security competence from the people you are conversing with.
> Impersonation
You can also do verification of your contacts. Best done in person where you can check the keys.
> MITM attack
> You can also lock registration of your device
Registration lock expires in seven days or less. [1]
[1]: https://support.signal.org/hc/en-us/articles/360007059792-Si...